A critical vulnerability in the WP Maps Pro WordPress plugin allowed unauthenticated attackers to create administrator accounts and potentially perform a complete site takeover on affected websites.  The issue impacted all WP Maps Pro versions up to 6.1.0. The plugin had more than 15,000 sales at the time the vulnerability was disclosed.  The vulnerability was submitted to the Wordfence Bug Bounty Program on March 24, 2026. Security researcher David Brown discovered and responsibly reported the flaw, earning a $1,950 bounty.  Wordfence stated that attackers could exploit a vulnerable AJAX action to create administrator accounts without authentication. 

How the WP Maps Pro WordPress Plugin Vulnerability Worked 

The WP Maps Pro WordPress plugin included a temporary access feature designed for support staff troubleshooting. The issue existed in the wpgmp_temp_access_ajax_callback() function, which handled the plugin’s AJAX action.  The function relied on a nonce check using fc-call-nonce: 

function wpgmp_temp_access_ajax_callback(){    check_ajax_referer( 'fc-call-nonce', 'nonce' );    $temp_access = new WPGMP_Temp_Access();    $response = $temp_access->wpgmp_temp_access_support();    wp_send_json($response);    exit(); }  

Researchers found that the nonce was publicly exposed through frontend pages using wp_localize_script. Because the AJAX action was also registered with wp_ajax_nopriv_, unauthenticated users could access the endpoint. The vulnerable version did not include a capability check to verify administrator privileges. 

Administrator Account Creation 

After triggering the AJAX action with check_temp=false, the plugin executed the wpgmp_temp_access_support() function.  The function created a new WordPress administrator account using: 

• A randomly generated username beginning with fc_user_ 
• The hardcoded email address support@flippercode.com 
• The administrator role 

The plugin then generated a login URL tied to the new account.  According to the technical analysis, visiting the generated URL triggered wp_set_auth_cookie(), authenticating the attacker without requiring a password.  Wordfence stated that attackers could then: 

• Install malicious plugins 
• Modify themes 
• Inject backdoors 
• Deploy webshells 
• Steal site data 

The vulnerability could result in full site takeover. 

Patch Released in Version 6.1.1 

The vendor fixed the issue by adding a capability check to the vulnerable AJAX action: 

if ( ! current_user_can( 'manage_options' ) ) {    wp_send_json_error( array( 'error' => 'Unauthorized' ), 403 );    exit(); }

 The patch restricted the endpoint to authenticated administrators only. The fully patched WP Maps Pro version 6.1.1 was released on May 20, 2026. 

Wordfence Timeline 

• March 24, 2026 — Wordfence received the vulnerability report. 
• May 16, 2026 — Researchers validated the exploit and escalated the issue to the Envato security team after failing to locate direct vendor contact information. 
• May 18, 2026 — Wordfence Premium, Care, and Response users received firewall protection. 
• May 20, 2026 — WP Maps Pro 6.1.1 was released. 
• June 17, 2026 — Free Wordfence users were scheduled to receive the same firewall protection. 

Wordfence urged users to update the WordPress plugin immediately to prevent exploitation and reduce the risk of site takeover. 

A recently disclosed Kali Forms vulnerability affecting a widely used WordPress plugin has escalated into an active security threat, enabling unauthenticated attackers to achieve Remote Code Execution on affected websites. The flaw impacts Kali Forms, a drag-and-drop form builder with more than 10,000 active installations, and has already been exploited in the wild shortly after public disclosure.  Security researchers reported that the vulnerability was first submitted on March 2, 2026, through a bug bounty program, identifying a critical Remote Code Execution issue in the Kali Forms vulnerability chain. The vendor released a patched version on March 20, 2026, and the issue was simultaneously added to the Wordfence Intelligence database. On the same day, attackers began actively exploiting it on scale. 

Timeline of the Kali Forms Vulnerability in the WordPress Plugin Ecosystem 

The Kali Forms vulnerability followed a rapid disclosure-to-exploitation cycle: 

• March 2, 2026: Initial submission of the Remote Code Execution flaw via bug bounty reporting. 
• March 5, 2026: Wordfence Premium, Care, and Response users received firewall protection. 
• March 20, 2026: Patched version released; vulnerability publicly disclosed; attackers began exploiting the same day. 
• April 4, 2026: Free Wordfence users received delayed firewall protection. 
• April 4–10, 2026: Peak exploitation activity observed against the Kali Forms vulnerability. 

The patched release addressed the issue in version 2.4.10 of the WordPress plugin, while all versions up to and including 2.4.9 remained vulnerable. 

Technical Root Cause Behind the Kali Forms Vulnerability

The core of this WordPress plugin flaw lies in how user-supplied form data is processed and stored internally. The vulnerability resides in the form_process flow and the prepare_post_data() function, which incorrectly maps attacker-controlled input into internal placeholder storage without proper validation or allow-list restrictions.  These placeholders are later used in the _save_data() method, where unsafe execution occurs through call_user_func().  A simplified excerpt of the vulnerable logic includes: 

if (isset($this->placeholdered_data['{entryCounter}'])) {    $this->placeholdered_data['{entryCounter}'] =        call_user_func($this->placeholdered_data['{entryCounter}'], $this->post->ID); } 

Because the Kali Forms vulnerability allows attackers to fully control values like {entryCounter} and {thisPermalink}, an unauthenticated user can inject arbitrary PHP function names. These are then executed directly, resulting in Remote Code Execution (RCE) attacks.  Researchers noted that the lack of input restrictions in prepare_post_data() enables overwriting internal placeholders. As a result, attacker-controlled values flow directly into call_user_func(), making exploitation trivial once the request is submitted.  One observed abuse pattern demonstrates authentication bypass attempts using built-in WordPress functions. For example, attackers can assign: 

• {entryCounter} = wp_set_auth_cookie  

• formId = 1  

This leads to execution of wp_set_auth_cookie(1), which may log attackers in as the default administrator account if it exists, effectively turning the Kali Forms vulnerability into a full account takeover vector. 

Active Exploitation of the Kali Vulnerability in Real-world Attacks 

Telemetry from security monitoring shows that exploitation began immediately after disclosure. Attackers have been systematically targeting the WordPress plugin using automated requests to admin-ajax.php.  A representative exploit request includes: 

POST /wp-admin/admin-ajax.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded action=kaliforms_form_process& data[formId]=1& data[nonce]=66ddddb2b7& data[entryCounter]=wp_set_auth_cookie 

This confirms how the Remote Code Execution flaw is triggered through manipulated form submission data.  Security systems recorded significant attack volume: 

• Over 312,200 exploit attempts were blocked targeting the Kali Forms vulnerability. 
• Heavy targeting was observed immediately after March 20, 2026 disclosure. 
• Increased spike in activity between April 4 and April 10, 2026. 

Top Attacking IP Addresses Observed 

Threat intelligence identified several IPs responsible for large-scale exploitation attempts: 

• 209.146.60.26 – over 152,000 blocked requests  
• 49.156.40.126 – over 50,000  
• 124.248.183.139 – over 26,000  
• 202.56.2.126 – over 14,000  
• 130.12.182.154 – over 11,000  
• 104.28.160.197 – over 9,000  
• 1.53.114.181 – over 5,700  
• 157.15.40.74 – over 3,000  
• 114.10.99.126 – over 2,500  
• 83.147.12.83 – over 1,300  

These sources were repeatedly associated with exploitation attempts targeting the Kali Forms vulnerability in the affected WordPress plugin.